For GETELEM/SETELEM we must check that its a native object first before trying to compare the objects shape to the shape of the global object to ensure its not aliasing the global object (457979, r=shaver).
authorAndreas Gal <gal@mozilla.com>
Tue, 30 Sep 2008 20:10:46 -0700
changeset 20017 b448ac318d3473a9aa58f9e82e3b20ae0afad2f8
parent 20016 33c1b3c0c44a493f295d1c12f0135d81894f0951
child 20018 2255cddff8effc470c66102a7d874503a20583dc
push id2577
push userbrendan@mozilla.com
push dateWed, 01 Oct 2008 04:35:27 +0000
treeherdermozilla-central@a613924403d6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersshaver
bugs457979
milestone1.9.1b1pre
For GETELEM/SETELEM we must check that its a native object first before trying to compare the objects shape to the shape of the global object to ensure its not aliasing the global object (457979, r=shaver).
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -3886,25 +3886,25 @@ TraceRecorder::guardDenseArrayIndex(JSOb
  * One win here is that we do not need to generate a guard that obj_ins does
  * not result in the global object on trace, because we guard on shape and rule
  * out obj's shape being the global object's shape at recording time. This is
  * safe because the global shape cannot change on trace.
  */
 bool
 TraceRecorder::guardElemOp(JSObject* obj, LIns* obj_ins, jsid id, size_t op_offset, jsval* vp)
 {
-    uint32 shape = OBJ_SHAPE(obj);
-    if (JSID_IS_ATOM(id) && shape == traceMonitor->globalShape)
-        ABORT_TRACE("elem op probably aliases global");
-
     LIns* map_ins = lir->insLoad(LIR_ldp, obj_ins, (int)offsetof(JSObject, map));
     LIns* ops_ins;
     if (!map_is_native(obj->map, map_ins, ops_ins, op_offset))
         return false;
 
+    uint32 shape = OBJ_SHAPE(obj);
+    if (JSID_IS_ATOM(id) && shape == traceMonitor->globalShape)
+        ABORT_TRACE("elem op probably aliases global");
+
     JSObject* pobj;
     JSProperty* prop;
     if (!js_LookupProperty(cx, obj, id, &pobj, &prop))
         return false;
 
     if (vp)
         *vp = JSVAL_VOID;
     if (prop) {